Class Client

# keycloak.openid.Client

Allows for creating and managing Keycloak clients that use the OpenID Connect protocol.

Clients are entities that can use Keycloak for user authentication. Typically, clients are applications that redirect users to Keycloak for authentication in order to take advantage of Keycloak's user sessions for SSO.

Example Usage

using Pulumi;
using Keycloak = Pulumi.Keycloak;

class MyStack : Stack
{
public MyStack()
{
    var realm = new Keycloak.Realm("realm", new Keycloak.RealmArgs
    {
        Enabled = true,
        Realm = "my-realm",
    });
    var openidClient = new Keycloak.OpenId.Client("openidClient", new Keycloak.OpenId.ClientArgs
    {
        AccessType = "CONFIDENTIAL",
        ClientId = "test-client",
        Enabled = true,
        RealmId = realm.Id,
        ValidRedirectUris = 
        {
            "http://localhost:8080/openid-callback",
        },
    });
}

}

Argument Reference

The following arguments are supported:

  • realm_id - (Required) The realm this client is attached to.
  • client_id - (Required) The unique ID of this client, referenced in the URI during authentication and in issued tokens.
  • name - (Optional) The display name of this client in the GUI.
  • enabled - (Optional) When false, this client will not be able to initiate a login or obtain access tokens. Defaults to true.
  • description - (Optional) The description of this client in the GUI.
  • access_type - (Required) Specifies the type of client, which can be one of the following:
  • CONFIDENTIAL - Used for server-side clients that require both client ID and secret when authenticating. This client should be used for applications using the Authorization Code or Client Credentials grant flows.
  • PUBLIC - Used for browser-only applications that do not require a client secret, and instead rely only on authorized redirect URIs for security. This client should be used for applications using the Implicit grant flow.
  • BEARER-ONLY - Used for services that never initiate a login. This client will only allow bearer token requests.
  • client_secret - (Optional) The secret for clients with an access_type of CONFIDENTIAL or BEARER-ONLY. This value is sensitive and should be treated with the same care as a password. If omitted, Keycloak will generate a GUID for this attribute.
  • standard_flow_enabled - (Optional) When true, the OAuth2 Authorization Code Grant will be enabled for this client. Defaults to false.
  • implicit_flow_enabled - (Optional) When true, the OAuth2 Implicit Grant will be enabled for this client. Defaults to false.
  • direct_access_grants_enabled - (Optional) When true, the OAuth2 Resource Owner Password Grant will be enabled for this client. Defaults to false.
  • service_accounts_enabled - (Optional) When true, the OAuth2 Client Credentials grant will be enabled for this client. Defaults to false.
  • valid_redirect_uris - (Optional) A list of valid URIs a browser is permitted to redirect to after a successful login or logout. Simple wildcards in the form of an asterisk can be used here. This attribute must be set if either standard_flow_enabled or implicit_flow_enabled is set to true.
  • web_origins - (Optional) A list of allowed CORS origins. + can be used to permit all valid redirect URIs, and * can be used to permit all origins.
  • admin_url - (Optional) URL to the admin interface of the client.
  • base_url - (Optional) Default URL to use when the auth server needs to redirect or link back to the client.
  • pkce_code_challenge_method - (Optional) The challenge method to use for Proof Key for Code Exchange. Can be either plain or S256 or set to empty value ``.
  • full_scope_allowed - (Optional) - Allow to include all roles mappings in the access token.

Attributes Reference

In addition to the arguments listed above, the following computed attributes are exported:

  • service_account_user_id - When service accounts are enabled for this client, this attribute is the unique ID for the Keycloak user that represents this service account.
Inheritance
System.Object
Resource
CustomResource
Client
Inherited Members
System.Object.Equals(System.Object)
System.Object.Equals(System.Object, System.Object)
System.Object.GetHashCode()
System.Object.GetType()
System.Object.MemberwiseClone()
System.Object.ReferenceEquals(System.Object, System.Object)
System.Object.ToString()
Namespace: Pulumi.Keycloak.OpenId
Assembly: Pulumi.Keycloak.dll
Syntax
public class Client : CustomResource

Constructors

View Source

Client(String, ClientArgs, CustomResourceOptions)

Create a Client resource with the given unique name, arguments, and options.

Declaration
public Client(string name, ClientArgs args, CustomResourceOptions options = null)
Parameters
Type Name Description
System.String name

The unique name of the resource
ClientArgs args

The arguments used to populate this resource's properties
CustomResourceOptions options

A bag of options that control this resource's behavior

Properties

View Source

AccessTokenLifespan

Declaration
public Output<string> AccessTokenLifespan { get; }
Property Value
Type Description
Output<System.String>
View Source

AccessType

Declaration
public Output<string> AccessType { get; }
Property Value
Type Description
Output<System.String>
View Source

AdminUrl

Declaration
public Output<string> AdminUrl { get; }
Property Value
Type Description
Output<System.String>
View Source

AuthenticationFlowBindingOverrides

Declaration
public Output<ClientAuthenticationFlowBindingOverrides> AuthenticationFlowBindingOverrides { get; }
Property Value
Type Description
Output<ClientAuthenticationFlowBindingOverrides>
View Source

Authorization

Declaration
public Output<ClientAuthorization> Authorization { get; }
Property Value
Type Description
Output<ClientAuthorization>
View Source

BaseUrl

Declaration
public Output<string> BaseUrl { get; }
Property Value
Type Description
Output<System.String>
View Source

ClientId

Declaration
public Output<string> ClientId { get; }
Property Value
Type Description
Output<System.String>
View Source

ClientSecret

Declaration
public Output<string> ClientSecret { get; }
Property Value
Type Description
Output<System.String>
View Source

ConsentRequired

Declaration
public Output<bool?> ConsentRequired { get; }
Property Value
Type Description
Output<System.Nullable<System.Boolean>>
View Source

Description

Declaration
public Output<string> Description { get; }
Property Value
Type Description
Output<System.String>
View Source

DirectAccessGrantsEnabled

Declaration
public Output<bool?> DirectAccessGrantsEnabled { get; }
Property Value
Type Description
Output<System.Nullable<System.Boolean>>
View Source

Enabled

Declaration
public Output<bool?> Enabled { get; }
Property Value
Type Description
Output<System.Nullable<System.Boolean>>
View Source

ExcludeSessionStateFromAuthResponse

Declaration
public Output<bool?> ExcludeSessionStateFromAuthResponse { get; }
Property Value
Type Description
Output<System.Nullable<System.Boolean>>
View Source

FullScopeAllowed

Declaration
public Output<bool?> FullScopeAllowed { get; }
Property Value
Type Description
Output<System.Nullable<System.Boolean>>
View Source

ImplicitFlowEnabled

Declaration
public Output<bool?> ImplicitFlowEnabled { get; }
Property Value
Type Description
Output<System.Nullable<System.Boolean>>
View Source

Name

Declaration
public Output<string> Name { get; }
Property Value
Type Description
Output<System.String>
View Source

PkceCodeChallengeMethod

Declaration
public Output<string> PkceCodeChallengeMethod { get; }
Property Value
Type Description
Output<System.String>
View Source

RealmId

Declaration
public Output<string> RealmId { get; }
Property Value
Type Description
Output<System.String>
View Source

ResourceServerId

Declaration
public Output<string> ResourceServerId { get; }
Property Value
Type Description
Output<System.String>
View Source

RootUrl

Declaration
public Output<string> RootUrl { get; }
Property Value
Type Description
Output<System.String>
View Source

ServiceAccountsEnabled

Declaration
public Output<bool?> ServiceAccountsEnabled { get; }
Property Value
Type Description
Output<System.Nullable<System.Boolean>>
View Source

ServiceAccountUserId

Declaration
public Output<string> ServiceAccountUserId { get; }
Property Value
Type Description
Output<System.String>
View Source

StandardFlowEnabled

Declaration
public Output<bool?> StandardFlowEnabled { get; }
Property Value
Type Description
Output<System.Nullable<System.Boolean>>
View Source

ValidRedirectUris

Declaration
public Output<ImmutableArray<string>> ValidRedirectUris { get; }
Property Value
Type Description
Output<System.Collections.Immutable.ImmutableArray<System.String>>
View Source

WebOrigins

Declaration
public Output<ImmutableArray<string>> WebOrigins { get; }
Property Value
Type Description
Output<System.Collections.Immutable.ImmutableArray<System.String>>

Methods

View Source

Get(String, Input<String>, ClientState, CustomResourceOptions)

Get an existing Client resource's state with the given name, ID, and optional extra properties used to qualify the lookup.

Declaration
public static Client Get(string name, Input<string> id, ClientState state = null, CustomResourceOptions options = null)
Parameters
Type Name Description
System.String name

The unique name of the resulting resource.
Input<System.String> id

The unique provider ID of the resource to lookup.
ClientState state

Any extra arguments used during the lookup.
CustomResourceOptions options

A bag of options that control this resource's behavior
Returns
Type Description
Client